REPTILE

Adversaries may buy, steal, or download malware that can be used during targeting.

Researchers observed the group deploying Linux rootkits, including REPTILE and MEDUSA, after exploiting vCenter and ESXi vulnerabilities.

Unlike other rootkit malware that typically only provide concealment capabilities, Reptile goes a step further by offering a reverse shell, allowing threat actors to easily take control of systems.

By using the macro, the code bypasses standard C library functions and directly interfaces with the system call: #define init_module(module_image, len, param_values) syscall(__NR_init_module, module_image, len, param_values)

The Reptile rootkit demonstrates this technique by installing a malicious udev rule under /etc/udev/rules.d/: ACTION=="add", ENV{MAJOR}=="1", ENV{MINOR}=="8", RUN+="/lib/udev/reptile"

upon examining the rc.local autorun script, it is evident that a command to ensure persistence exists between the tags “#<intel_audio>” and “#</intel_audio>” | It also supports persistence through Udev. The following rules file is created in the /lib/udev/rules.d/ directory... to ensure that it will be executed even after a reboot.

This setting is particularly useful for hardening a system against certain types of attacks, such as attempts to load malicious kernel modules (think rootkits) or manipulate the system at a low level. Mandiant recently published a blog post where they found, among other toolings used by the attackers, REPTILE. REPTILE is an open-source Linux rootkit, implemented as a loadable kernel module (LKM), that provides backdoor access to a system.

Aside from the concealment and Port Knocking features, Reptile provides a feature where the “root” command can be used to give the current user root privileges.

The Reptile rootkit demonstrates this technique by installing a malicious udev rule under /etc/udev/rules.d/: ACTION=="add", ENV{MAJOR}=="1", ENV{MINOR}=="8", RUN+="/lib/udev/reptile"

upon examining the rc.local autorun script, it is evident that a command to ensure persistence exists between the tags “#<intel_audio>” and “#</intel_audio>” | It also supports persistence through Udev. The following rules file is created in the /lib/udev/rules.d/ directory... to ensure that it will be executed even after a reboot.

This setting is particularly useful for hardening a system against certain types of attacks, such as attempts to load malicious kernel modules (think rootkits) or manipulate the system at a low level. Mandiant recently published a blog post where they found, among other toolings used by the attackers, REPTILE. REPTILE is an open-source Linux rootkit, implemented as a loadable kernel module (LKM), that provides backdoor access to a system.

Reptile is an open-source kernel module rootkit that targets Linux systems... Reptile’s concealment capabilities include not only its own kernel module but also files, directories, file contents, processes, and network traffic.

Within the Makefile, a random 32-bit hexadecimal value is generated... This value serves as the encryption key for the Reptile Kernel object, making it difficult to identify the module through simple hash searches or hex value hunts on the filesystem. The encrypted Kernel module is stored in reptile.ko.inc.

To avoid scrutiny during process enumeration or system monitoring, rootkits often rename their processes and threads to match benign system components. Common disguises include: kworker, migration, or rcu_sched... sshd, systemd, dbus-daemon, or bash.

This direct syscall approach allows the custom loader to insert the Kernel module without relying on higher-level functions, which can help avoid detection mechanisms that monitor typical command-line usage patterns.

The content repeatedly describes malware and threat actors decoding, decrypting, or deobfuscating payloads, strings, configuration data, commands, and C2 traffic prior to execution or use, e.g., 'APT28 macro uses the command certutil -decode to decode contents of a .txt file storing the base64 encoded payload' and 'Action RAT can use Base64 to decode actor-controlled C2 server communications.'

Reptile provides a concealment feature for files, directories, processes, and network communications. | Reptile provides a file tampering feature, which allows the contents of a file to be hidden... the strings between these tags are concealed. | When a PID is given along with the “hide” or “show” command, the process of the PID is concealed... hooking next_tgid() makes it so that the concealment target’s process is skipped, making it invisible in the /proc/ list.

The content repeatedly describes malware and threat actors creating hidden folders, adding dot prefixes to filenames, and setting file attributes such as hidden/system to conceal files and directories from users and defenders.

Based on this, a reverse shell connects to the C&C server.

TABLEFLIP passively listens on all active interfaces for specialized command packets that contain an XOR encoded IP address and port to redirect traffic to using iptables commands.

Port Knocking is a method where the malware opens a specific port on an infected system and goes on standby. When the threat actor sends a Magic Packet to the system, the received packet is used as a basis to establish a connection with the C&C server.

The content repeatedly describes malware and threat actors using SSL, TLS, HTTPS, RSA, AES, Blowfish, RC4, ECIES, Diffie-Hellman, OpenSSL, WolfSSL, and mutual TLS to protect command and control traffic.